No information flow using statistical fluctuations, and quantum cryptography 
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The communication protocol of Home and Whitaker [Phys. Rev. A 67, 022306 (2003)] is examined in some 
detail, and found to work equally well using a separable state. The protocol is in fact completely classical, based 
on simple post-selection of suitable experimental runs. The quantum cryptography protocol proposed in the 
same publication is also examined, and is found to indeed need quantum properties for the system to be secure. 
However, the security test proposed in the mentioned paper is found to be insufficient, and a modification is 
proposed here that will ensure security. 
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PACS numbers: 03.67.Hk, 03.65.Ud, 03.67.Dd 



I. INTRODUCTION 

Information transfer using quantum entanglement is a sub- 
ject of great interest presently. Quantum teleportation 
S 4J is one of the more prominent applications, although 
it has caused some debate about what is teleported or not 
and on the relation to nonlocality and inseparability 

IM 1^ mil . Since quantum entanglement is one of the 
important resources in quantum information theory, the inter- 
est in these issues is not surprising. One application is that 
of quantum computers which would have a big impact on our 
world when/if one is actually built. One more immediate ap- 
plication is quantum cryptography [12. .O. .14.1 . and one pro- 
posal of a quantum-cryptographic protocol will be discussed 
below. 

First we will look at a quantum communication setup pre- 
sented in [15], that uses the experimental setup but not the 
communication protocol of the quantum teleportation exper- 
iment. The protocol of 1 15] (to be described briefly below) 
is intended to communicate apparatus settings from Alice to 
Bob without transmitting the settings on the classical channel 
that connects Alice and Bob. This procedure is then extended 
in 1 15] to make a quantum cryptography protocol. Here, these 
two will be critically examined in order. 

The communication protocol is as follows: Alice and Bob 
share one half each of many copies of a maximally entangled 
2-part spin- J state indexed 2 and 3, and Alice has an addi- 
tional particle at her disposal indexed 1, so that the total state 



1^123) = («|Tl)+^Ul));)5(|T2i3 



U2T3>; 



(1) 



using the obvious notation for eigenstates of s^n (and we will 
denote the measurement results S^,, below). The coefficients a 
and b are chosen to be real here, so that + = 1 . Should 
one want to use complex coefficients, each occurrence of 
and below should be exchanged for jap and j/jp, respec- 
tively. An alternative way to write the state is 



123/ 



[\^>+^){-a\h)+b\i,)) 

+ l^r2)(-«it3)-feU3)) 

+ |4>+)(-/7|t3)+«|i3)) 

+ \^-,^){ + b\h)+a\h))], 



(2) 



where we have used the Bell basis 



|^l2) = 72(lTli2> + UlT2>) 
l'J'r2) = 7l(ltli2)-UlT2)) 
l^n)-72(ltlT2) + Uli2)) 
l*r2) = 7l(ltlT2>-Uli2>). 



(3) 



Each run of the protocol uses four of these trios as follows. 

Alice performs either (a) four Bell-state measurements on 
her two particles 1 and 2 or (b) four measurements of S^i and 
5,2- In either case, if Alice should happen to get different 
measurement results on her side in all four measurements [de- 
noted "criterion Q" in Ref. [ 15]], she announces "OK" to Bob 
on the classical channel. Bob, on the other hand, always per- 
forms four measurements of S^t, and calculates the sum 5,31 of 
these results. If he received "OK" on the classical channel, the 
two possibilities of settings at Alice give different probability 
distributions of 5,3t. 

If Alice's setting was (a). Bob has the probability of get- 
ting for two of the four particles in the group, and the 
probability b^ of getting +h for the other two particles. This 
is easily seen in Eq. (|2ji, and implies the following for the 
probability distribution of the sum. 



P(5,3t = 2h) = P(S,3t = -2h) = a^b'^ 
P{Sat = fi) = P{S,3t = -fi) = 2a^b^{a'^ + b'^) 
P{Sat = 0)=a^+ 4flV + b^. 

Looking at expectation values, we see that 

(5,3t)=0; {S%i) ^4n^a^b^, 



(4) 



(5) 



where the latter is zero only if a 01 b is zero. 

If Alice's setting was (b) instead, inspection in Eq. Q 
shows that Bob will get two each of "up" and "down", or in 
other words that 



P(5,3t = Ih) = P(5,3t = /i) = PiSat = 

= Pfet = -2ri)=0; P(5,3t = 0) = l, 



so 



(5,30-0; (40=0. 



(6) 



(7) 
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Bob now checks if the value of 5,3t he received is zero or 
nonzero. In the case his measured sum is nonzero he knows 
with certainty that AUce's setting was (a), in the ideal case, 
since it is obvious in Eq. (|6j that nonzero values only occur 
for setting (a). If the measured sum is zero, the situation is 
different. We have 



while 



-0 



setting (b) = 1, 



setting (a) ) =a 



(8) 



(9) 



To distinguish the setting (a) from the setting (b), one wants 
the error probability in Eq. (|9} to be as small as possible. It 
is minimized if a ^ b ^ I / \/2, for which it is 3/8 = 0.375. 
If the protocol is modified to use 4N triads rather than four, 
this probability can be made arbitrarily small. The proto- 
col will indeed indicate to Bob which setting Alice has used, 
even though the "OK" that Alice sent on the classical channel 
seems to have nothing to do with the setting she chose. 



n. A SEPARABLE-STATE IMPLEMENTATION 



It is noted in Ref. 11511 that maximal entanglement is not 
necessary for this scheme, but it is argued that entanglement 
does play a role. Let us look at this claim closer. Suppose that 
the state used is not that of Eq. Q) but the separable mixed 
state 



Pi23=(«'ITi)(Til + ^'Ui)ail) 

®Klt2i3)(T2i3| + U2T3)a2T3|). 

Rewriting this in the Bell basis yields the expression 



(10) 



Pl23 -4 



( 1^12)^2 1 + I*r2)(^ 



121 



(11) 



(S^{a'\h){h\+b'\l3) (hi; 
.(|<1>+)(<I>+| + |<I>-2)(<I>-2| 

^{b^\h){h\+Ci^\i3){i3\] 

(l^i2)(*r2l + l^r2)W2l) 

^{a^\h){h\-b^\i3){l3\) 

( 1*12) (*r2l + 1*72)^2!) 

^{b^\h){h\-a^\i3){U\ 



where the first parenthesis contains the diagonal elements. 
The question now is what happens when using the above pro- 
tocol on Pi23- Let us assume that Alice has received four dif- 
ferent measurement results [criterion Q] and announced "OK" 
on the classical channel. 

If Alice's setting was (a). Bob has the probability of get- 
ting +h for two of the four particles in the group, and the 
probability b^ of getting +h for the other two particles. This 



is easily seen in Eq. (II 1> . from this follows that the probability 
distribution of the sum is 

P(5,3, = 2h) = P{S,3t = -2h) = 
P{S--n = h) = P{S,3, = -h) = 2flV(fl4 + /,4) (22) 
= 0) = fl** + 4fl4/,4 ^ 



Looking at expectation values, we see that 



(13) 



where the latter is zero only if a or b is zero. 

If Alice's setting was (b) instead, inspection in Eq. dlOt 
shows that 



P(5,3t = 2h) = P(5,3t = h)= P{S,3, = -h) 

= P(5,3t = -2h) = 0; P(5,3t = 0) = 1 , 



(%,>=0; (4,>=0. 



(14) 



(15) 



This is exactly the same as Eqs. 0-0, so the conclusion is 
the same. There is another way to see this because, with a and 
b possibly complex, 

I^Prn) C^ml = («|Ti)+^Ui))(«(Ti|+^ai|) 



(16) 



®i(IT2i3)-U2T3))((T2i3|-(i2T3|) 
:pi23-(«|Tl>+^Ul>)(«(Tl|+^(il|) 
®^(|T2i3>(i2T3| + U2T3> (T2i3|) 

+ («^|ti>(ii| + fl/7Ui)(Ti|) 

^^(|T2i3)(T2i3|-U2T3) (i2T3|). 



Note that the last two terms are off-diagonal only. Writing 
ll'ns) (^123 1 in the Bell basis on particles 1 and 2 will yield a 
full matrix in the density representation, consisting of 64 ele- 
ments. Let us not write that large expression here, but simply 
note that 

1^123) (^i23| =\ [( 1^12) (^12! + I^r2) (^nl ) 
®{a^\h) (T3|+fc'|i3>(i3|) 

+ (|i'i2)K2l + |i'r2>(*r2l) 

®{a^M{iMb^\h){h\)^ ^^^^ 

off-diagonal terms 

=Pi23 + off-diagonal terms 

So, it is clear from Eq. (I17> that for (a) Bell-state measure- 
ments at Alice and 5'^^3 measurements at Bob, the two states 
will yield the same statistics. Similarly, it is clear from 
Eq. M6\ that for (b) measurements of S^„ at Alice and Bob, 
the two states will yield the same statistics. The densities have 
equal diagonal elements in both expansions, and are therefore 
impossible to distinguish if Alice and Bob are only allowed to 
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use measurements (a) or (b), and measurement of 5-3, respec- 
tively. A discussion of the role of the off-diagonal elements 
in regular quantum teleportation can be found in Ref. |5]. Of 
course, the off-diagonal elements will play a role if Alice and 
Bob are allowed other measurements than the ones singled out 
above. Especially, only allowing Bob measurements of 5^3 is 
a severe restriction, but we will investigate this further in Sec- 
tion l^below. 

However, for the proposed protocol, the separable mixed 
state pi23 will produce the same results as 1^123) (^123 1- In 
fact, the protocol does not use any specifically quantum prop- 
erties of the system, it uses classical postselection to obtain 
the desired statistics. Postselection is known to sometimes 
give unexpected results (see, e.g., 



III. A COIN-TOSS IMPLEMENTATION 

It is not difficult to implement this protocol using a number 
of classical unbiased and biased coin tosses. To make it look 
like the above setup, we will use three coins ci, C2 and C3 that 
are divided so that Alice can read off the results from coins ci 
and C2 while Bob can read the result of coin C3. 

Coin ci is biased so that 



-I) 



where we have used +1 to denote "heads" and 
"tails". Coin C2 is fair, i.e.. 



P{C2 



-11 



P{C2 



-1) 



(18) 
1 to denote 



(19) 



and coin C3 always gives the opposite result to coin cj- This 
can be implemented using one coin toss at the "source of the 
C2-C3 pair," communicating the result to Alice, and the oppo- 
site result to Bob, both on a classical channel. In addition, we 
will need a fair coin C4 that Alice will use in case (a) below. 
An important comment to make is that the coins ci, C2, and C4 
should be independent. 

The protocol proceeds as above, with groups of four tosses 
of the coins C1-C4. A "measurement" consists of reading off 
the result of a coin toss. Alice reads either (a) four results of 
C4 and the product ciC2 [which, in a way, corresponds to the 
Bell-state measurement used previously], or (b) four results of 
ci and C2- In either case, if Alice should happen to get four 
different results on her side [criterion Q], she announces "OK" 
to Bob on the classical channel. Bob, on the other hand, al- 
ways reads off C3, and calculates the sum C3t of the results. If 
he received "OK" on the classical channel, the two possibili- 
ties of settings at Alice give different conditional probability 
distributions of c^f 

The case when Alice used setting (b) is trivial, since Bob 
wiU receive two each of +1 and —1, so the probability distri- 
bution reads 



P(c3, = 2)-P(c3t = l)=P(c3t = -l) 

= P(c3t = -2)=0; P(c3t = 0) = l, 
and the classical expectations are 

£(c3t)=0; £(4)=0. 



(20) 



(21) 



The case when Alice's setting was (a) is a more complicated 
and, for clarity, let us do the calculation explicitly. Since the 
coins ci and C2 are independent and C2 is fair. 



(22) 



P{ciC2 = -l) = ^, 
and since C3 = — C2 we have 

p(c3 = -inciC2 =- 1) =P(c2 = +1 nci = -1) 

= P(c2 = +l)P(ci=-l) = i/7- 

Thus 



D, II 1^ ^"(^3 = ~-lnciC2 = -1) ,2 
P{C3 = -l|ciC2 = -1) = — = 



1.2 (23) 



P(C1C2 = -1) 

and from that follows 

P(c3 = +l|ciC2 = -1) = a^. 
From a similar calculation we obtain 



P(C3 = -l|ciC2 



P(c3-+l|ciC2 = +l)=fe2 



(24a) 
(24b) 

(25) 



An "OK" from Alice means that the result of C1C2 was +1 
twice and — 1 twice. This implies that the probability distribu- 
tion of the sum C3t must be 

P(c3t - 2) - P(c3t = -2) - flV 

P(c3t = 1) =P(c3t = -1) = 2fl2/,2(fl4_^^4) (26) 

P(c3t = 0) =fl**+4flV + /7^. 



Looking at expectation values, we see that 

£(c3t)=0; £(4)=4flV, 



(27) 



where the latter is zero only if a or b is zero. 

This is the same statistics as obtained before (modulo the 
measurement-result labels ±h), so this completely classical 
scheme implements the protocol just as well as the previous 
two quantum systems. 



IV. QUANTUM CRYPTOGRAPHY 



The second issue in llSr is to provide a quantum cryptog- 
raphy protocol based on the above procedure. As is usual, 
Alice and Bob are assumed to have an open but unjammable 
classical channel to communicate on, and a quantum channel 
that in this case consists of the common source emitting par- 
ticles 2 and 3. Alice has two random sequences of bits, one 
that provides the raw key to be transmitted to Bob over the 
quantum channel, and another that decides the encoding to be 
used. Bob has a third random bit sequence that decides the 
decoding he will use. 

Note that the described use of three different random bit 
sequences is very similar to the BB84 1 12] protocol. The dif- 
ference is that the present setup uses a source of entangled 
pairs of qubits, much as in Ekert quantum cryptography Lljll 
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but, as we will see shortly, without the Bell inequality test. 
Another difference is the usage of several pairs of qubits for 
transmission of a bit in the key, as described below. 

For each bit with the value 1 in the raw key Alice makes (a) 
4N Bell-state measurements, and for each bit with the value 
she uses the encoding bit-sequence to determine which to 
perform of (b) 4N measurements of S-i and S-,2, or (c) 4-N 
measurements of S^i and 5^2- Bob, who knows nothing of 
Alice's two bit sequences, uses his decoding bit sequence to 
determine which to perform of (b') 4N measurements of 5,3 
or (c') 4N measurements of 5^3. 

Given that Alice receives the four possible results times 
each [criterion Q], she announces the encoding to Bob (but 
not the key bit), i.e., which setting of (b) or (c) she used. If 
she happened to use setting (a), the encoding bit will make 
her announce one of (b) or (c) to Bob, randomly with equal 
probability. This means that Alice transmits the encoding bit 
to Bob, but not the raw key bit; she does not transmit any 
information about the raw key over the classical channel. 

Bob discards data where his setting was (b') and Alice an- 
nounced (c), and where his setting was (c') and Alice an- 
nounced (b). For the remaining runs, when he used setting 
(b') he can determine whether Alice's setting was (a) or (b) by 
the earlier protocol, and similarly when he used setting (c') he 
can determine whether Alice's setting was (a) or (c). He can 
now determine the bits of the raw key for the experimental 
runs that remain after the above filtering. He also communi- 
cates which runs he is using to Alice, but neither the settings 
nor the resulting bit. The remaining bit sequence (the sifted 
key) will now be equal at Alice and Bob, or at least as equal 
as possible, see below. They have established a key to use in 
their cryptographic scheme. 

There will be some noise in the sifted key even in the ideal 
case, because Bob cannot with certainty say, for example, 
whether Alice used (a) or (b). If Bob receives a nonzero result 
in his measurement of S^ji, he knows that Alice's setting was 
(a) but if Bob receives a zero result, the probability that Alice 
used setting (b) is larger than 5 but there is a nonzero proba- 
bility that the setting was (a). This probability will depend on 
a, b and and tend to zero as tends to infinity. In a real 
implementation one has to choose finite, otherwise the key 
rate will be zero. For example, when a = b and N = 1, 

Table 1 

Normal operation: P(OK) — ^ 



AHce's bit Bob's bit 


Probability 





1 


1 





1 


3 

8 


1 1 


5 
8 



The visible effect will be that some ones in Alice's bit- 
sequence will arrive as the value zero at Bob. In the ideal 
case, no zeros will become one, so evidently, Bob's copy of 
the sifted key will have slightly more zeros than Alice's copy. 

Comparing this cryptographic scheme with the previously 
described communication scheme, the set of possible mea- 
surement setups is extended so that the off-diagonal terms in 



the expansion of 1^123) (^123 1 come into play, making that 
particular state or another entangled state a requirement for 
the quantum cryptography scheme. And the whole idea of 
quantum cryptography is to use specifically quantum proper- 
ties of a system in such a way that eavesdropping always will 
be detectable. It is noted in Ref. {H that if |'Pi23) (^123! is 
used, and the eavesdropper Eve makes 4A^ measurements of 
either 5,3 or 5^3 at random, she will be detected. In the case 
a ~ b and A^ = 1 , we have 

Table 2 





Eve is listening 


: f (OK) = 


6 

" 64 


Alice's bit Eve's basis Bob's bit 


Probability 





correct 





1 





correct 


1 








incorrect 





3 
8 





incorrect 


1 


5 
8 





(mean) 





11 

16 





(mean) 


1 


5 

16 


1 


either 





3 
8 


1 


either 


1 


5 
8 



Apparently, there will be extra noise, but only in the zeros. In 
comparison to the BB84 protocol, the situation is as follows: 

Table 3 







BB84 HW|T5] 


Alice's bit 


Eve is 


f (error) P(error) 





absent 





1 


absent 


1 





present 


1 5 
4 16 


1 


present 


1 3 
4 8 



The performance of BB84 is better than the protocol of 
Home and Whitaker flS*] when Eve is absent, while the figures 
are comparable when Eve is present. Of course, the protocol 
of II5II uses more qubits per sifted key bit than BB84. Both 
protocols will reject half the data outright (when the "settings" 
disagree at Alice and Bob), but in addition, the protocol of 
lITsIl uses four qubits for each raw key bit and of these only 
6/64 will yield a bit in the sifted key, that is, when Alice an- 
nounces "OK" on the classical channel. Also there is another 
problem, which we will turn to now. 

V. A COHERENT ATTACK 

If the source is in an insecure location, or if Eve has access 
to both the quantum channel going from the source to Alice 
and that going to Bob, she can replace the source with her 
own. Eve can of course replace the source emitting the entan- 
gled state with a source randomly emitting either 4A^ copies 
of the mixed state 

^(|Tz2iz3) (Tz2iz3| + U..2Tz3) (Uhil) , (28a) 



5 



or 4N copies of 



r ( I tx2 1x3 ) ( Tx2 1x3 I + U.v2 Tx3 ) ( ix2 1x3 I ) , 



(28b) 



but that would yield the same statistics as that obtained when 
Eve is simply eavesdropping on (one of) the quantum chan- 
nels. And then, Alice and Bob can use a statistical test to 
detect Eve's precense. 

Eve can do something more clever than transmitting 4N 
copies of a mixed state, but let us now restrict ourselves to 
the case N — I and a — b for simplicity. Note that Eve has 
complete freedom of choosing what state to send to Alice and 
Bob, including what sequence of states to send. She can for 
instance choose to send the sequence 



|T.2U3)(Tz2i^3|, 

liz2U(iz2Tz3|, Uz2k3)az2Tz3l: 



(29) 



which would yield a key bit of zero at Bob if Bob uses the (b') 
setting: measurement of ^^stot; in the above sequence, the sum 
of the received spins is zero. At Alice, the sequence will yield 
"OK" if Alice uses the (b) setting. In a different notation. Eve 
will have sent the state 



IQ2) = |T'2T?2iz2iz2) 



(30) 



to Alice (the upper index on the right-hand side denotes the 
timeslot, and in hexadecimal — IIOO2 perhaps with the 
name "qunybble" 0)> 



|3z3) = |iz3iz3Tz3Tz3) 



(31) 



to Bob. Obviously, this state is only good if Alice and Bob 
do not use (c) and (c'). If they do, the probability of "OK" 
at Alice is 6/64 since the results will be random at Alice, and 
there will be some noise in the "transmitted" key bit at Bob, 
since the measurement results will be random there as well. 
But Eve has one more ace up her sleeve: entanglement. 
Note that 



iz3; 



'z3; 



|0,3> + |F,3>j + (|3,3) + |C,3) 
5.v3) + |A,3))-f|9,3) + |6,3 



(32a) 



|5z3> + |A,3> 



|0;,3> + |F,3) 
5x3) + |A,-3 



3.v3> + |C,3> 
-f|9x3) + |6x3 



(32b) 



Letting q = exp(2/;r/3). Eve can choose to transmit the state 
1^3.00), given by 

V6|r3,oo) 

= ( |3z3) + IQ3) ) +<?( |5z3) + |Az3) ) +q\\%i) + |6z3) ) 
= ( |3x3> + |Q3> )+q[ |5,-3) + |A,3) )+q^{ |9x3> + |6x3) ) , 

(33) 

for which the result of measuring either of the sum ^^stot and 
the sum 5v3tot is zero. The above is an entangled state, but the 
entanglement is in the sequence of particles emitted to Bob 
instead of the pairwise entanglement between particles 2 and 
3 in the original source. Bob will always receive the mea- 
surement result zero, irrespective if his setting is (b') or (c'); 
this particular source is "tuned" for zeros. In addition, if Eve 
transmits the same state to Alice, or rather the corresponding 
I V2.oo)^ Alice will have a higher chance of getting "OK" if she 
uses the setting (b) or (c), since the results at particle 2 will be 
two of "up" and two "down". The probability of getting "OK" 
is then j (or 16/64) rather than the usual 6/64. We have 

Table 4 

Eve tunes the source for zeros 



Ahce's bit P(OK) Bob's bit 



16 
64 

16 
64 
6_ 
64 
6_ 
64 



Probability 



1 

1 




Eve cannot use this source only, since only zeros would 
be transmitted (correctly) to Bob. But Eve can also tune the 
source to produce ones; note that 



|0z3) - |Fz3> =T 



l.v3) + 
4x3> 



ID 



(I 



|Bx3) 



while 



tz3; 



iz3; =T 



ix3/ 



-'x3/ 



(|4x3)-|B.3) 



x3/ 
|7.v3> 

|D,3 

8x3) - |7x3) 



(34) 



^x3; 



(35a) 



|2z3> - |D,3> 



lx3)-|E,3)j-(|2,3)-|D,3 
|4x3>-|B.3>) + (|8,3>-|7,3)) 



and 



(35b) 



|9z3) + |6z3)=2 ( |0x3) + |Fx3) 



|5x3> + |A,3) 



3x3) + |C,3 
|9x3> + |6,3> 



(32c) 



|4z3>-|Bz3)=x 



|lx3)-|E,3) j + (^|2,3)-|D,3 
(|4x3)-|B.3>) + (|8.3>-|7.3> 



(35c) 



6 



and 



|8a) - |7.3> =^ [( I lx3> - |E.3> ) + ( |2.3> - |D,3) ) 

+ (|4.3)-|B.3>)-(|8.v3>-|7.3) 



(35d) 



So Eve could use the state | V^s.ii)^ where 
VT0|v/3,ii)-(|0,3>-|F,3)) 

+ ^(|L3) + |2,3) + |4,3> + |8,3>) 
+ ^2(^|E,3) + |D,3) + |B,3) + |6,3; 
= (|0,2>-|F,2>) 

+ ^(|1,2> + |2,2) + |4,2) + |8,2)) 
+ 92(|E,2) + |D,2) + |B,2) + |6,2)), 

for which the relevant probabilities are 



(36) 



Table 5 

Eve tunes the source for ones 



Alice's bit P(OK) Bob's bit 


Probability 














1 


1 


^ 64 








1 ^ 

^ 64 


1 


1 



Eve does not want to change the ratio of ones to zeros in 
the transmitted key from that of the raw key, since that would 
enable a statistical test for her presence. The rate of OK's 
should be 6/64 irrespective of whether Alice has a or a 1 in 
her raw key. This will be achieved by letting Eve's source be 
tuned for zeros with a probability of 6/16, and be tuned for 
ones with a probability of 10/16. In quantum language. Eve 
would tune the source to send 

1 1 V^2,00'K3,00) ( V^2,00 V^3,00 | + 1 1 1/2,1 1 ^3,1 1 ) ( ^2.1 1 ^3.1 1 1 ■ 

(37) 

Remarkably, this is the same ratio as is required to make the 16 
different bit combinations of the four particles equally prob- 
able, something also desired by Eve, because otherwise, e.g.. 
Bob could test the statistical properties of his unfiltered data 
to detect Eve. With this ratio, the probability of "OK" is 



P OK 



and 



P OK 



RawkeybitisO (38a) 



(38b) 



Rawkeybitisl)=-|.A + |0.^ = ^ 



Zeros are transferred only when the source is tuned for zeros, 
which also means that there will be no errors in the zeros, in 
the ideal case. However, ones will be "transferred" both when 



the source is tuned for ones (no errors in the ideal case) and 
when the source is tuned for zeros (all errors in the ideal case). 
With the above weighting, the rate of errors in the ones will 
be 



P\Boh gets a 
We arrive at 



OK, Raw key bit is 1 = -n- 



1 + 10 
^ + 16 



= 



8 

(39) 



Table 6 

Eve tunes the source: f(OK) = ^ 



Alice's bit Bob's bit 


Probability 





1 


1 





1 


3 
8 


1 1 


5 
8 



This table is identical to Table 1, "Normal operation." Eve is 
controlling the source, and she knows what values Bob will 
recieve when Alice announces "OK" on the classical channel. 
She has, quite surprisingly, used entanglement to her benefit 
for a coherent attack on the four qubits making up a single 
key bit value. The errors occur exactly like in the case Eve is 
absent. 



VI. THE PERFECT ILLUSION? 

So Eve has a way to eavesdrop unnoticed on Alice and Bob, 
at least if the security test used is the one proposed in Sec- 
tion II VI estimating the error rate in the sifted key. But note 
that with the above tuned source, if Alice receives a spin sum 
is equal to zero. Bob will also receive a spin sum equal to 
zero, regardless of the setting they use. And (provided they 
have read this paper) Alice and Bob will by now know to test 
this in their system. Is this then enough? 

Let us see if Eve can construct a system that obeys the fol- 
lowing: 

(i) Eve can eavesdrop, or alternatively, control the source 
so that she knows in advance what the results should be 
for both measurement settings 

(ii) if Alice gets spin-sum zero at one setting, then Bob also 
should get spin-sum zero at the same setting 

(iii) the spin-sum at one setting at Bob is statistically inde- 
pendent of the spin-sum at the other setting at Alice, 
and vice versa 

(iv) the 16 different local results are equally probable at ei- 
ther setting 

It takes some calculation to determine a state with these 
desired properties (desired by Eve, that is), but one such state 
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^ I V2,OOV'3,Oo)( V2,00V^3,00 1 



^ 1 0:2,01 0:3,01 )(«2,oi«3,oi I + 1 0^,100:3,10) ( 0^,100:3,10 1 

p|^2,01^3,0l)(ft.0lfc,0l| + ^|^2,10^3,lo)(^2,10^3,lo| 
^|r2,0l73,0l)(72,0l73,0l| + ^|/2,10/3,10)(')4.10/3 



3,10 



+ ^l^2,ia3,ll)(Z2,llZ3,ll| + ^|Z2,llZ3,ll)(Z2,llZ3, 
+ ^|fell^3.1l)(02,1103,ll|- 



(40) 



Here, the first index of the pure states in the pure-state ex- 
pansion is the particle index as used before, and the later two 
indices indicate which bit value the particular state is tuned 
for, in the bases (b) and (c), in order The included states are 
I V'3,00) defined in Eq. ( I33> . and 



0:3,01, 



1 



3.3) - ic. 



z3) 



2V2 



(|l.v3>-|E.3 
|4,3) - |B,3) 



12,3) - |D, 
«) — 1 7.1-3) 



lA 



3.01; 



1 



( I5.3> - |A,3) 



2V2 



2V2 



together with their "mirrored" counterparts 

10:3,10)= ^ 



2V2 



-^|l,3)-|E,3)j-(|2,3)-|D,3) 
+ (|4,3)-|B,3)) + (|8,3)-|7,3)) 
3x3)-|C,3)y 



We also need the state 

|;t3.oi>=^(|0,3>-|F,3) 



1 



2V2 



II, 



(|4.v3 



IE.3) 
H |B,3 



1.3) + |D,3 



+ (|8.3> + |7.3)) 



(41a) 



- (11,3) -|E,3)j + (12,3) -|D,3)j (41b) 

-(|4.3>-|B.3>) + (|8.3>-|7.3>)], 
|73,01>=^(|9,3)-M) 

^ ^- (11.3) -|E.v3)) + (12,3) -|D,3)) (41c) 
+ (|4.3)-|B,3))-(|8,3>-|7,3>)" 



(42a) 



(43) 



mirrored in the same way, and finally. 



103, 



2V2 



2V2 



(|L3>-|E,3>) + 
-(|4z3>-|B,3> 
|lx3)-|E,3) 
4..3> - |B,3 



2z3> - |D,3) 

.3>-|7.3; 

12,3) - |D,3) 
x3) — 1 7x3 



(44) 



Each of these states show the same properties as the states that 
were used in Section|V| given that Alice and Bob use the same 
settings, but show different behaviour when they use different 
settings. For example, if Eve sends IPimPi-Oi) and Alice and 
Bob both use the (b) setting (or Alice (a) and Bob (b)), the 
results will follow Table 4 because this state is tuned for zeros 
in this basis. If Alice and Bob both use the (c) setting (or 
Alice (a) and Bob (c)), the results will follow Table 5 because 
this state is tuned for ones in this basis. If they use different 
settings, the spin sum will differ at the two sites. 

The statistics obtained from the state in Eq. ( I40t follows the 
behaviour of the original state exactly, as far as the spin sums 
are concerned, and Table 6 gives the key-transmission errors. 
The existence of this state shows that only checking the key 
bits, or indeed, checking statistical properties of the spin sums 
at the two sites at any combination of the two settings, will 
not provide any security. 

Is the illusion perfect, then? Not at all. For example, if the 
spin sum is one of the extreme values at one site, e.g., a result 
of 0^2 or F,2, there will be no occurrences of spin sum zero 
at the other site at the other setting, i.e., none of 3^3, 5;t3^ 6v3, 
9,3, A ,3, and C,3 will occur Simply put, this is because there 
is no possibility to make 



(45) 



|0,3) + |F,3)=Cl |3,3) + |C,3 



-C2(|5,3> + |A,3>)+C3(|9,3> + |6,3)) 



in fact. 



|0^3) + |F,3)=2 



^x3 



|Fv3) 



.5x3; 



IC. 



■x3. 



(|5.v3) + |A,3>) + (|9,3> + |6.v3>) 



(46) 



In other words, there is no possibility to combine the value 
or F in one basis (and no spin sum zero results there) with only 
spin sum zero in the other. And this property of the quantum 
state space together with requirements (i)-(iv) makes it im- 
possible for Eve to combine an extreme spin sum result at one 
site at one setting with a spin sum zero at the other site at the 
other setting. 

Thus, Ahce and Bob absolutely must augment their test for 
noise in the key with a 

Test to see whether the full local results at one 
setting is independent of the spin sum at the re- 
mote site at the other setting. 
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Testing independence of the spin sums at different settings 
is not enough. I would perhaps go so far as conjecturing that 
the protocol would be secure given the mentioned two tests 
(and a test that the local results occur with equal probability), 
but I would not really recommend using them as tests of se- 
curity of the protocol. There are two reasons for this: they 
would provide a relatively weak statistical test, since the test 
cases occur quite rarely; but a more important reason is that 
the tests are complicated to motivate, and it would perhaps be 
difficult to convince a potential user that it ensures security, 
even if it may be possible to present a formal security proof. 
The lesson from this is instead that one needs to analyze the 
full local data set together with information from the remote 
site. Since this is necessary, one may as well choose a much 
simpler and more easily motivated security test that does re- 
spect this structure: 

Test the individual qubits at the two sites. That is, 
test whether the local results at one setting is the 
same as the remote results at the same setting. 

This test would provide the kind of security intended in 
fis'l, and would fail if Eve uses the kind of source described 
above. 



VII. CONCLUSIONS 

The communication protocol proposed in 1 15] does clearly 
not use any specifically quantum properties of the quantum 
teleportation setup. In particular it does not need an entan- 
gled state since a separable state performs equally well. The 
system is using classical postselection of appropriate experi- 
mental runs to transfer the data. One could have hoped that the 
quantum properties of the quantum system of either SectionU 
or im would enhance Bob's chance of distinguishing Alice's 
setting (a) from (b), but this is not the case, since the protocol 



shows the same performance using the purely classical system 
of Sectionlini 

As to the quantum-cryptographic protocol of fl^ . the us- 
age of several qubits to transmit a single key bit is problem- 
atic. Simply testing for noise in the sifted key is not suffi- 
cient in this quantum-cryptographic scheme, because Eve can 
use entanglement to her benefit, to eavesdrop without being 
noticed. In Section IVTI we noted that an additional test was 
needed; a test for independence of the remote spin sum with 
the full local result. But a simpler test was also suggested; to 
test whether the remote qubit results are identical to the local 
qubit results if the same setting is used at the two sites. 

Of course. Eve will have a difficult time establishing the 
entangled mixed state needed for eavesdropping when Alice 
and Bob use the originally proposed test. But this is more a 
technological issue; the above reasoning is talking about the 
protocol as being (in)secure in principle, just as L15il is talking 
about the protocol as being usable in principle. 

Since it is necessary to test the individual qubits to obtain 
a secure system, the protocol does seem wasteful because it 
only uses entanglement present in groups of AN qubits for key 
transmission. Also, when Alice's raw key bit is 1, no entan- 
glement at all is used, since the behaviour of the protocol in 
this situation is derived from the fact that Bob's results are 
statistically independent from Alice's. Many runs will also be 
discarded because Alice will send "OK" quite seldom, since 
criterion Q (see Section HVl will be fulfilled with probabihty 

only m- 

In all, little of the available entanglement is put to good 
use, even when the qubits are individually tested, since the 
sifted key is derived from a joint result of several qubit mea- 
surements. Entanglement is a valuable resource, and should 
be used with care. In conlusion, while these protocols are 
theoretically interesting, they are probably not very useful in 
practice. 
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